Server not recognizing %2b as valid image path

Question

Running IIS 7

I'm running on a shared hosting account and I have a file on my server named +.jpg but when I try to navigate to it via the URL

   http://example.com/images/%2b.jpg

The server doesn't respond properly and my browser returns "Webpage not found" error.

On my developer machine, this works fine. What option should I tell my hoster to enable so that URLs of that sort are accepted?

Answer 1

Looks like the issue is a 404.11 error caused by a double escape sequence:

HTTP Error 404.11 - Not Found The request filtering module is configured to deny a request that contains a double escape sequence.

and is detailed in this KB article.

Running this command:

Appcmd set config "Default Web Site" /section:system.webServer/Security/requestFiltering -allowDoubleEscaping:True

allows the file to be served.

In your case, you can add this section to your application's web.config:

<requestFiltering allowDoubleEscaping="true" />

as described in this TechNet article.

Answer 2

The plus sign (+) is a reserved character per RFC2396:

Many URI include components consisting of or delimited by, certain special characters. These characters are called "reserved", since their usage within the URI component is limited to their reserved purpose. If the data for a URI component would conflict with the reserved purpose, then the conflicting data must be escaped before forming the URI.

  reserved    = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "+" |

                "$" | ","

Wade Hilmo has an excellent post titled How IIS blocks characters in URLs. There's lots of information and background provided. The part specifically for the plus sign is as follows:

So allowDoubleEscaping/VerifyNormalization seems pretty straightforward. Why did I say that it causes confusion? The issue is when a ‘+’ character appears in a URL. The ‘+’ character doesn’t appear to be escaped, since it does not involve a ‘%’. Also, RFC 2396 notes it as a reserved character that can be included in a URL when it’s in escaped form (%2b). But with allowDoubleEscaping set to its default value of false, we will block it even in escaped form. The reason for this is historical: Way back in the early days of HTTP, a ‘+’ character was considered shorthand for a space character. Some canonicalizers, when given a URL that contains a ‘+’ will convert it to a space. For this reason, we consider a ‘+’ to be non-canonical in a URL. I was not able to find any reference to a RFC that calls out this ‘+’ treatment, but there are many references on the web that talk about it as a historical behavior.

From my own experience I know that when IIS logs a request spaces are substituted with a plus sign. Having a plus sign in the name may create confusion when parsing logs.

There are three ways to fix this and two ways to still use the plus sign.

1. allowDoubleEscaping=true - This will allow double escaping for your entire website/application. Depending on the content, this could be undesirable to say the least. The following command will set allowDoubleEscaping=true.

   appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /allowDoubleEscaping:True
   

2. alwaysAllowedUrls - Request Filtering offers a whitelist approach. By adding that URL path to alwaysAllowedUrls, the request will not be checked by any other Request Filtering settings and continue on in the IIS request pipeline. The concern here is that Request Filtering will not check the request for:

• Request Limits: maxContentLength, maxUrl, maxQueryString
• Verbs
• Query - query string parameters will not be checked
• Double Escaping
• High Bit Characters
• Request Filtering Rules
• Request Header Limits

The following command will add /+.jpg to alwaysAllowedUrls on the Default Web Site.

    appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"alwaysAllowedUrls.[url='/+.jpg']"

3. Rename - yes, just rename the file/folder if possible. This is the easiest solution.